Details on synthetic patches: As in [1]}, we optimized these patches under transformation using an auxiliary classifier to regularize them to not appear like the target class.
Unlike [1]}, we do not use a GAN discriminator for regularization or use an auxiliary classifier to regularize for realistic-looking patches.
Also in contrast with [1]}, we perturbed the inputs to the generator in addition to its internal activations in a certain layer because we found that it produced improved adversarial patches.
